DATA PROCESSING ADDENDUM
This Data Processing Addendum (the “Addendum”) is incorporated into the Service Agreement (“Agreement”) and applies in respect of the provision of the Services to the Client if the Client is subject to the GDPR, only to the extent the Client is a Controller of Client Personal Data (as defined below) that Company Processes on behalf of the Client. The Addendum is intended to satisfy the requirements of Article 28(3) of the GDPR and, prior to the date on which the GDPR takes effect, the requirements of Article 17(3) of the EU Data Protection Directive (95/46/EC). This Addendum shall be effective for the term of the Agreement.
2.1 For the purposes of the Addendum:
- “Client Personal Data” means Personal Data submitted, stored, uploaded or otherwise provided by Client through its use of the Services, in respect of which the Client is the Controller, as further described under Section 3 of this Addendum;
- “GDPR” means the General Data Protection Regulation (EU) 2016/679, together with any national implementing laws in any Member State of the European Union, as amended, repealed, consolidated or replaced from time to time; and
- “Personal Data”, “Data Subject”, “Data Protection Authority”, “Data Protection Impact Assessment”, “Process”, “Processor” and “Controller” will each have the meaning given to them in the GDPR.
2.2 Capitalized terms not otherwise defined herein shall have the meaning given to them in the Agreement.
3. Details Of The Processing
3.1 Categories of Data Subjects. This Addendum applies to the Processing of Client Personal Data relating to Client’s customers or patients or prospects and other end users, the extent of which is determined and controlled by Client in its sole discretion.
3.2 Types of Personal Data. Client Personal Data includes the following types of Personal Data: names, title, position, contact information (including email addresses and phone numbers), purchase or services information, and other data ,the extent of which is determined and controlled by Client in its sole discretion.
4. Processing Of Client Personal Data
4.1 Each of the Client and the Company will comply with their respective obligations under the GDPR, to the extent applicable to the Processing of any Client Personal Data in the context of the provision of the Services
4.2 Company will only Process Client Personal Data as a Processor on behalf of and in accordance with the Client’s prior written instructions and for no other purpose. Company is hereby instructed to Process Client Personal Data to the extent necessary to enable Company to provide the Services in accordance with the Agreement.
4.3 If for any reason (including a change in applicable law) Company becomes unable to comply with any instructions of the Client regarding the Processing of Client Personal Data, Company will promptly:
- notify the Client of such inability, providing a reasonable level of detail as to the instructions with which it cannot comply and the reasons why it cannot comply, to the greatest extent permitted by applicable law; and
- cease all Processing of the affected Client Personal Data (other than merely storing and maintaining the security of the affected Client Personal Data) until such time as the Client issues new instructions with which Company is able to comply (and if this provision applies, Company will not be liable to the Client under the Agreement in respect of any inability to perform the Services until such time as the Client issues new instructions).
4.3 As a part of providing the Services, Company may transfer, store and process Client Personal Data in the United States, where Company’s parent Reputation.com, Inc. is established. Reputation.com, Inc. participates in and has certified its compliance with the EU-U.S. Privacy Shield Framework as set forth by the U.S. Department of Commerce with respect to the processing of Client Personal Data that is transferred from the EU to the U.S. in accordance with the terms of this Addendum.
5.1 Company will ensure that any person whom Company authorises to Process Client Personal Data on its behalf is subject to confidentiality obligations in respect of that Client Personal Data.
6. Security Measures
6.1 Company will implement appropriate technical and organisational measures to protect against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Client Personal Data.
7. Appointment Of Sub-Processors
7.1 Client authorises Company to appoint sub-Processors to perform specific services on Company’s behalf which may require such sub-Processors to Process Client Personal Data. If Company engages a sub-Processor to Process any Client Personal Data, it will:
- inform Client of any intended changes concerning the addition or replacement of such sub-Processors and Client will have an opportunity to object to such changes on reasonable grounds within [fifteen (15) business days] after being notified. If the parties are unable to resolve such objection, either party may terminate the Agreement by providing written notice to the other party;
- keep the Client informed if there is any change to the role or status of the sub-Processor; and
- enter into a binding written agreement with the sub-Processor that imposes on the sub-Processor the same obligations that apply to Company under the Addendum.
7.2 For the purposes of this provision, the Company’s parent Reputation.com, Inc. based in the United States is deemed to have been authorised to Process Client Personal Data.
8. Data Subject Rights
8.1 Company will, at the Client’s request and subject to the Client paying all of Company’s fees at prevailing rates, and all expenses, provide the Client with assistance necessary for the fulfilment of the Client’s obligation to respond to requests for the exercise of Data Subjects’ rights. Client shall be solely responsible for responding to such requests.
9. Security Breaches
9.1 Company will:
- notify the Client as soon as practicable after it becomes aware of any loss, compromise or any unauthorised access to, or breach of the security of, any Client Personal Data; and
- at the Client’s request and subject to the Client paying all of Company’s fees at prevailing rates, and all expenses, promptly provide the Client with all reasonable assistance necessary to enable the Client to notify relevant security breaches to the relevant Data Protection Authorities and/or affected Data Subjects.
10. Data Protection Impact Assessment; Prior Consultation
10.1 Company will, at the Client’s request and subject to the Client paying all of Company’s fees at prevailing rates, and all expenses, provide the Client with reasonable assistance to facilitate:
- conduction of Data Protection Impact Assessments if the Client is required to do so under the GDPR; and
- consultation with Data Protection Authorities, if the Client is required to engage in consultation under the GDPR,
in each case solely to the extent that such assistance is necessary and relates to the Processing by the Company of the Client Personal Data, taking into account the nature of the Processing and the information available to the Processor.
11. Deletion of Client Personal Data
11.1 Company will permanently and securely delete (or, at the election of the Client, return, in such format as Company may reasonably elect and subject to the Client paying all of Company’s fees at prevailing rates, and all expenses, for transferring the Client Personal Data to such format) all Client Personal Data in the possession or control of Company or any of its sub-Processors, within 90 days after Company ceases to provide the Services, unless the applicable law of the EU or of an EU Member State requires otherwise. Company will procure that its sub-Processors do likewise.
12.1 The Company will, at Client’s request and subject to the Client paying all of Company’s fees at prevailing rates, and all expenses, provide the Client with all information necessary to enable the Client to demonstrate compliance with its obligations under the GDPR, and allow for and contribute to audits, including inspections, conducted by the Client or an auditor mandated by the Client, to the extent that such information is within Company’s control and Company is not precluded from disclosing it by applicable law, a duty of confidentiality, or any other obligation owed to a third party.